freeipa/daemons/ipa-slapi-plugins/ipa-pwd-extop
Alexander Bokovoy a9bcf531a6 ipa-pwd-extop: do not remove MagicRegen mod, replace it
In 2012, ldbm backend in 389-ds started checking entry modification
after running betxnpreop plugins by comparing a number of modifications
before and after. If that number didn't change, it is considered that
plugins didn't modify the list.

ipa-pwd-extop actually removed and re-added modification to ipaNTHash if
it contained 'MagicRegen' value. This did not work since commit
https://pagure.io/389-ds-base/c/6c17ec56076d34540929acbcf2f3e65534060a43
but we were lucky nothing in FreeIPA code actually relied on that except
some code paths in ipasam Samba passdb driver. However, Samba didn't
reach the point where the code was triggered -- until now.

With support to run Samba as a domain member in IPA domain, that code
path is triggered for Kerberos service principals of domain members
(cifs/client.example.test, ...) and NT hash extraction from Kerberos
keys does not work.

Fix ipa-pwd-extop to follow recommendations in
https://pagure.io/389-ds-base/issue/387#comment-120145 and
https://pagure.io/389-ds-base/issue/50369#comment-570696

Fixes: https://pagure.io/freeipa/issue/7953
Reviewed-By: Christian Heimes <cheimes@redhat.com>
2019-05-28 09:55:51 +03:00
..
common.c Don't abuse strncpy() length limitation 2018-10-24 16:11:55 +02:00
encoding.c Heap corruption in ipapwd plugin 2016-07-19 13:17:37 +02:00
ipa_pwd_extop.c Keytab retrieval: allow requesting arcfour-hmac for SMB services 2019-05-28 09:55:51 +03:00
ipapwd.h Simplify date manipulation in pwd plugin 2016-07-25 05:08:55 -04:00
Makefile.am slapi plugins: fix CFLAGS 2017-03-15 08:55:12 +00:00
otpctrl.c Rename syncreq.[ch] to otpctrl.[ch] 2016-05-26 18:47:05 +02:00
otpctrl.h Migrate from #ifndef guards to #pragma once 2016-05-29 14:04:45 +02:00
prepost.c ipa-pwd-extop: do not remove MagicRegen mod, replace it 2019-05-28 09:55:51 +03:00
pwd-extop-conf.ldif Enable transactions by default, make password and modrdn TXN-aware 2012-11-21 14:55:12 +01:00
README Mass tree reorganization for IPAv2. To view previous history of files use: 2009-02-03 15:27:14 -05:00